VPC-integrated dedicated instance

Use cases

A VPC-integrated dedicated instance optimizes the network architecture between API Gateway and your VPC. This instance type applies to the following scenarios:

• Multi-resource access within a VPC — APIs hosted on the gateway use multiple resources in the same VPC as backend services, such as ECS and SLB instances. Typical scenarios include microservices architectures and service discovery solutions such as Nacos.

• Hybrid cloud networking — The backend service requires the egress IP address of the gateway instance to be a private IP address in the VPC when API Gateway forwards API requests. For more information, see Scenario 3: API Gateway accesses a backend service in an on-premises data center over an internal network.

  

Comparison with conventional dedicated instances

The following comparison helps you choose between a VPC-integrated dedicated instance and a conventional dedicated instance.

How to choose:

• Single VPC with multiple backend resources — Choose a VPC-integrated dedicated instance. It connects directly to your VPC without per-resource authorization.

• Multiple VPCs with backend resources — Choose a conventional dedicated instance. It supports multiple VPC access authorizations for resources across different VPCs.

• DataWorks Data Service integration — Choose a conventional dedicated instance. VPC-integrated dedicated instances are not supported for this scenario.

  * The egress IP address of a gateway instance is the TCP source IP address that a backend service sees when API Gateway forwards an API request to the backend service.

For information about VPC access authorizations used with conventional dedicated instances, see Use a resource in a VPC as the backend service of an API.

Prerequisites

Before you create a VPC-integrated dedicated instance, make sure that the following requirements are met:

• VPC and vSwitch — A VPC and at least one vSwitch are created. The resources in your VPC that serve as API backends reside in the CIDR block of the vSwitch.

• Service-linked role — API Gateway requires a service-linked role to manage elastic network interfaces (ENIs) in your VPC. For more information, see Service-linked role for connecting API Gateway to a user VPC.

• CIDR block planning — The vSwitch CIDR block does not overlap with the internal resource CIDR blocks used by API Gateway. For the reserved CIDR blocks by region, see Reserved CIDR blocks of VPC-integrated dedicated instances by region.

• Security group rules — The outbound rules of the security group allow traffic to the destination IP CIDR blocks of your backend services.

Create an instance

To create a VPC-integrated dedicated instance, set the instance type to VPC integration instance on the purchase page.

In addition to the VPC-specific settings described below, configure the general settings on the purchase page: Region and zone (for example, China (Hangzhou)), Instance Specifications (for example, api.s1.small, which displays parameters such as the maximum number of requests per second, the SLA, the maximum number of concurrent requests, and the outbound bandwidth), HTTPS Security Policy (for example, HTTPS2_TLS1_0), Network billing type (for example, pay-by-traffic), and Instance Name.

Manage accessible CIDR blocks

By default, a VPC-integrated dedicated instance can access only the services in the CIDR block of the vSwitch that you specified during instance creation. To view the default accessible CIDR blocks, go to the instance details page in the API Gateway console and check the Access to Backend Service VPC section.

If other services reside in different CIDR blocks within your VPC and need to be accessed by API Gateway, add the CIDR blocks manually.

1. Log on to the API Gateway console. In the left-side navigation pane, choose Instances.

2. Find the VPC-integrated dedicated instance and click Add in the Access Allowed From column.

3. Add a CIDR block by using one of the following methods: Select from list or Enter manually.

   If you enter a CIDR block manually, make sure that the CIDR block resides in the VPC that you specified when you created the instance, or is connected to that VPC.

   After the CIDR block is added, verify that it appears in the Access Allowed From list on the instance details page.

Use a VPC access authorization as a backend service

A VPC-integrated dedicated instance can use a VPC access authorization as a backend service. The instance uses the ENIs in your VPC to directly access the services defined in the VPC access authorization.

Before you configure a VPC access authorization for an API or a plug-in on a VPC-integrated dedicated instance, make sure that the following conditions are met:

• The VPC ID in the VPC access authorization is the same as the ID of the VPC connected to the instance.

• The private IP address of the service in the VPC access authorization resides in the accessible CIDR block of the VPC-integrated dedicated instance.

  If API Gateway returns an error similar to "instance cannot connect to the backend xxx.xxx.xxx.xxx" when you publish an API or modify a plug-in, check whether the private IP address in the error message resides in the accessible CIDR block of the instance.

Migrate API groups to a VPC-integrated dedicated instance

Modify Instance for API Group Deployment To migrate your workloads to a VPC-integrated dedicated instance, you can change the deployment instance of an API group from a serverless instance or a conventional dedicated instance to a VPC-integrated dedicated instance.

1. Log on to the API Gateway console. In the left-side navigation pane, choose API Groups.

2. Find the API group and click the group name to go to the group details page.

3. Click Modify Instance for API Group Deployment and select the target VPC-integrated dedicated instance.

4. API Gateway validates the VPC access authorizations used by the APIs and the associated plug-ins in the original group. If the validation succeeds, the migration is complete. If the validation fails, the migration fails and the reason is displayed.

Validation conditions

Before the migration, the same conditions listed in Use a VPC access authorization as a backend service must be met for all VPC-based services, including APIs and plug-ins. In addition, the following migration-specific conditions apply:

• If your API group uses a VPC access authorization, make sure that the Security Group of the ECS or SLB service in the authorization is the same as the Security Group that you specified when you created the VPC-integrated dedicated instance.

Post-migration considerations

After the migration, the internal egress IP address changes to the egress IP address of the target instance. If your backend service uses a whitelist, add the new address to the whitelist before the migration to prevent access failures after the migration.

After the migration is complete, call your APIs to verify that backend services are reachable through the new instance.

Reserved CIDR blocks of VPC-integrated dedicated instances by region

The following tables list the reserved CIDR blocks for API Gateway internal resources in each region. Make sure that the vSwitch that you specify does not overlap with these CIDR blocks.

Hangzhou

Shanghai

Shanghai Finance Cloud

Beijing

Beijing Finance Cloud

Shenzhen

Shenzhen Finance Cloud

Heyuan ACDR Auto

Zhangjiakou

Chengdu

Qingdao

Hong Kong

Singapore

Indonesia (Jakarta)

Malaysia (Kuala Lumpur)

Japan (Tokyo)

South Korea (Seoul)

Germany (Frankfurt)

UK (London)

US (Silicon Valley)

US (Virginia)

UAE (Dubai)

Saudi Arabia (Riyadh)